In the field of electric actuators for the control surfaces of vehicles such as aircraft and boats, there is a common method of controlling certain surfaces that incorporates an electric servo actuator and a combination of switches and/or relays to apply electrical power to the servo. These systems allow an operator to cause the servo to drive in either of two directions, for example up and down, or left and right, thereby allowing a control surface of the vehicle to be actuated in a particular manner or direction. Often these systems use a combination of single or multi-pole momentary switches of the single or double throw type to provide an input into the control system. For example, an electric elevator trim actuator, a pair of single pole-double through momentary switches may be used to actuate an up and a down trim motion of the trim servo. When these switches are actuated the trim servo is driven in a particular direction. The duration of the application of power to the servo controls the amount of trim adjustment made. Therefore, the amount of trim adjustment is controlled by the amount of time the switch is held closed. Additionally, the switches may be used to actuate other intermediate electrically controllable devices such as relays or semi-conductor switches such as transistors which in turn provide electrical power to the servo actuators.
This system of switches, electrically controllable devices and servos are typically connected in a very simple system as described to provide the actuation of a control surface. However, this system has a significant drawback from the possible failure modes that exist with devices such as switches, relays and transistors. If one of these components fails in an electrically shorted state, due to either electrical or mechanical reasons, the electrically actuated servo may receive continuous electrical power. This in turn will drive the servo to the end of its mechanical travel which in turn may drive a moveable control surface to an extreme position. An un-commanded movement of a control surface can have a significant negative effect on the performance of a vehicle. This simple system may also suffer from an undesired movement of a control surface if an operator accidentally activates one of the mentioned input switches. In the case of a general aviation aircraft these switches are located on the main control yoke or stick and are subject to inadvertent activation by an operator.
Prior art solutions to this problem have been rudimentary and include providing an additional power switch to manually disconnect power from the control system. This system required the operator to stop a run-away condition as described by disconnecting power from the malfunctioning system. Additionally, another known system includes a switch to reverse the activity of the electrically actuated servo. Both of these configurations rely on the operator's ability to detect, troubleshoot and correct the ensuing problem very quickly. Many known electrically actuated servos can move from one extreme position to the other in about 10-15 seconds. This short period of time allows for a very limited reaction time for an operator to resolve a run-away condition. Another means to mitigate this problem in prior-art systems is to include a speed control function in the driver of the electrical servo. The speed controller is used to slow down the movement of the servo thereby giving the operator more time to detect the occurrence of a run-away control system.
It is therefore highly desirable to provide a control system that limits the travel of an electrically activated servo and does not require a human operator to rapidly detect a failure mode or run-away condition. Additionally, it is desirable to provide an electrical control system that may operate an electrical servo based system at a selectable speed that further can reduce the effects of a failure condition. The system beneficially mitigates the effects of an un-commanded operation that would normally drive a moveable control surface to the full extent of its travel. Additionally, it is desirable to have a control system that can detect and terminate a run-away condition of the control system and provide an operator a means to reverse an un-commanded activity which has already taken place. A need also exists for a control system that can terminate a run-away condition regardless of which component or components in a system fail. Preferably the system would terminate a run-away commanded by multiple simultaneous failures of components.